turnstile-spin

Agent skill from cloudflare/skills.

cloudflare ↓ 14k

Claude Code

View source ↗

What it does

"Turnstile", "CAPTCHA", "bot protection"
"siteverify", "cf-turnstile-response"
"protect this form", "stop bot signups", "spam signups"
A specific signup, login, or contact form combined with "Cloudflare" or "bot"
ok: continue to Step 4. The script already picked the account (single-account token, or one matching $CLOUDFLAREACCOUNTID).
Frontend framework (Next.js, Astro, SvelteKit, Hugo, vanilla, etc.) → drives the widget embed snippet.
Backend handler location (Express route, Next.js API route, Rails controller, Workers fetch handler, Pages Function, etc.) → drives the siteverify snippet.

Requirements & configuration

ok: continue to Step 4. The script already picked the account (single-account token, or one matching $CLOUDFLAREACCOUNTID).
1. Export + relaunch (token never enters chat): export CLOUDFLAREAPITOKEN=<token> then restart the agent from that terminal.
2. Save to file (token in file with user-only perms, not in chat): umask 077 && printf '%s' '<token>' > ~/.cf-turnstile-token, then read with TOKEN=$(cat ~/.cf-turnstile-token).
3. Paste in chat (fastest, but token lands in conversation log; user should rotate it after if the log is ever shared).
accountmismatch: $CLOUDFLAREACCOUNTID is set but isn't one of the token's accounts. Show the accounts list and ask the user to either unset CLOUDFLAREACCOUNTID or set it to one of those IDs.

Configuration: CLOUDFLARE_ACCOUNT_IDTOKENREADMEAGENTSWIDGET_SECRETTURNSTILE_SECRETRECAPTCHA_SECRETHCAPTCHA_SECRET

Derived from the skill's own SKILL.md documentation · extracted 2026-07-23

Source

Repository: https://github.com/cloudflare/skills

turnstile-spin FAQ

What does the turnstile-spin skill do?

Set up Cloudflare Turnstile end-to-end in a project. Scan the codebase, create the widget via the Cloudflare API, embed it on the right forms, wire canonical server-side siteverify in the customer's existing backend, validate, and persist the skill. Load this when a user asks to add Turnstile, set up CAPTCHA, protect a form from bots, or fix a Turnstile integration. Mirrors developers.cloudflare.com/turnstile/spin. "Turnstile", "CAPTCHA", "bot protection" "siteverify", "cf-turnstile-response"

What does turnstile-spin require?

ok: continue to Step 4. The script already picked the account (single-account token, or one matching $CLOUDFLAREACCOUNTID). 1. Export + relaunch (token never enters chat): export CLOUDFLAREAPITOKEN=<token> then restart the agent from that terminal. 2. Save to file (token in file with user-only perms, not in chat): umask 077 && printf '%s' '<token>' > ~/.cf-turnstile-token, then read with TOKEN=$(cat ~/.cf-turnstile-token). 3. Paste in chat (fastest, but token lands in conversation log; user should rotate it after if the log is ever shared). accountmismatch: $CLOUDFLAREACCOUNTID is set but isn't one of the token's accounts. Show the accounts list and ask the user to either unset CLOUDFLAREACCOUNTID or set it to one of those IDs. Configuration keys: CLOUDFLARE_ACCOUNT_ID, TOKEN, README, AGENTS, WIDGET_SECRET, TURNSTILE_SECRET, RECAPTCHA_SECRET, HCAPTCHA_SECRET.

How do I install turnstile-spin?

Run: npx -y skills add https://github.com/cloudflare/skills --skill turnstile-spin --agent claude-code — the source lives at github.com/cloudflare/skills.

Maintain turnstile-spin?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[![turnstile-spin on getagentictools](https://getagentictools.com/badge/skills/cloudflare-skills-turnstile-spin.svg)](https://getagentictools.com/skills/cloudflare-skills-turnstile-spin?ref=badge)

npx agentictools info skills/cloudflare-skills-turnstile-spin

The second line is the CLI lookup for this page — handy in READMEs and docs.